VULNERABILITY

Oracle Linux: CVE-2021-38575: ELSA-2021-3066: edk2 security update (IMPORTANT) (Multiple Advisories)

Try Surface Command Get a continuous 360° view of your attack surface
Back to Search

Oracle Linux: CVE-2021-38575: ELSA-2021-3066: edk2 security update (IMPORTANT) (Multiple Advisories)

Severity
8
CVSS
(AV:N/AC:H/Au:N/C:C/I:C/A:C)
Published
06/08/2021
Created
07/26/2024
Added
07/22/2024
Modified
01/07/2025

Description

NetworkPkg/IScsiDxe has remotely exploitable buffer overflows. A flaw was found in edk2. Missing checks in the IScsiHexToBin function in NetworkPkg/IScsiDxe lead to a buffer overflow allowing a remote attacker, who can inject himself in the communication between edk2 and the iSCSI target, to write arbitrary data to any address in the edk2 firmware and potentially execute code. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Solution(s)

  • oracle-linux-upgrade-edk2-aarch64
  • oracle-linux-upgrade-edk2-ovmf

References

insightVM

Advanced vulnerability management analytics and reporting.
Key Features
  • Lightweight Endpoint Agent
  • Live Dashboards
  • Real Risk Prioritization
  • IT-Integrated Remediation Projects
  • Cloud, Virtual, and Container Assessment
  • Integrated Threat Feeds
  • Easy-to-Use RESTful API
  • Automation-Assisted Patching
  • Automated Containment
Free InsightVM Trial WATCH DEMO

With Rapid7 live dashboards, I have a clear view of all the assets on my network, which ones can be exploited, and what I need to do in order to reduce the risk in my environment in real-time. No other tool gives us that kind of value and insight.

– Scott Cheney, Manager of Information Security, Sierra View Medical Center

;